service_control_manager | Detection.FYI

QBot scheduled task REGSVR32 with C$ image path

Mar 18, 2025 · attack.persistence attack.privilege-escalation attack.t1053.005 ·
Share on:

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Read More
Disable Windows Defender via Service

Feb 26, 2024 · attack.execution attack.t1569.002 attack.t1562.001 dist.public ·
Share on:

Detects Windows Defender disabling service installation

Read More